Windows Event Log

The Windows Event Log (Eventlog) service enables event log messages that are issued by programs and components in the Windows operating system that are to be viewed in Event Viewer. These event log messages contain information that can help diagnose issues with applications, services, and the operating system.

You cannot stop the Windows Event Log service. If you disable the service, it would be impossible to track events, which significantly reduces the ability to successfully diagnose computer issues. Also, security events would not be audited, and you could not view previous event logs with the Event Viewer console.

This service is installed by default and its startup type is Automatic.

When the Windows Event Log service is started in its default configuration, it logs on by using the Local Service account.

The following table identifies the application protocols, network protocols, and ports that are used by the Windows Event Log service:

Application protocol Network protocol Ports
RPC/named pipes TCP 139
RPC/ named pipes TCP 445
RPC/ named pipes UDP 137
RPC/ named pipes UDP 138

The following system components are dependent upon the Windows Event Log Service:

  • Operations Manager Audit Forwarding Service
  • Task Scheduler
  • Windows Event Collector

Related content